From 0e26c19afa3e9a758453755bf8d10f43003e3b53 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Wed, 28 Oct 2026 07:45:46 -0400
Subject: [PATCH] MT#55283 fix possible array overflow

Change-Id: I712069a139c9e9d494e4a2fc912ab0cdacbac986
(cherry picked from commit 96432024b791221c0944e4506d94d415caf7eea1)
(cherry picked from commit 1fbf6abcb5bb3fd9c5c5220444eb951022325749)
---
 daemon/media_socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index 89ac3595a..bb06d3839 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -1527,7 +1527,7 @@ static void fill_bundle_pt_stats(kernelize_state *s, struct call_media *bundle,
 	__auto_type iter = t_hash_table_iter(bundle->pt_media);
 	void *pt;
 	struct call_media *pt_media;
-	while (t_hash_table_iter_next(&iter, &pt, &pt_media)) {
+	while (t_hash_table_iter_next(&iter, &pt, &pt_media) && s->num_payload_types < RTPE_NUM_PAYLOAD_TYPES) {
 		struct packet_stream *pt_ps = get_media_component(pt_media, component);
 		if (!pt_ps)
 			continue; // log as error?